Email Header Analyzer

A message's full headers (View Source or Show Original in a mail client) record its entire path through mail servers, along with sender-authenticity check results. This tool breaks those headers down into readable fields and flags signs of spoofing.

How to use it

• Paste raw email headers and the tool extracts the main fields (From, To, Subject, Date) along with the Received chain and the timing of each hop.
• SPF, DKIM, and DMARC results are shown separately with an explanation of what each status (pass, fail, none) means.
• A mismatch between the From and Reply-To headers is flagged — a common sign of phishing.

Common uses

• Checking a suspicious email for signs of phishing before trusting its links or attachments.
• Debugging why a legitimate email lands in spam by checking its SPF/DKIM/DMARC status.
• Tracing an email's actual path through servers to understand a delivery delay.

Things to keep in mind

The Date header is set by the sender's client and can be inaccurate; for an exact timeline, trust the timestamps in the Received chain, which are added by the mail servers themselves.

Passing SPF/DKIM/DMARC only confirms the message is technically authorized by the sending domain — it doesn't guarantee the content itself isn't phishing or spam.